[PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove_writeback()

[Hamza Mahfooz]

On 2022-09-29 11:36, Felix Kuehling wrote:
> I'm still seeing a warning even with this fix:
> 
> /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ?dc_stream_remove_writeback?:
> /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: warning: array subscript 1 is above array bounds of ?struct dc_writeback_info[1]? [-Warray-bounds]
>    527 |     stream->writeback_info[j] = stream->writeback_info[i];
>        |                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
> 

What version of GCC are you using? I don't see it on GCC 12.2 with this 
patch applied.

> Regards,
>    Felix
> 
> 
> Am 2022-09-27 um 16:35 schrieb Pillai, Aurabindo:
>>
>> [AMD Official Use Only - General]
>>
>>
>> [AMD Official Use Only - General]
>>
>>
>> Reviewed-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
>>
>> -- 
>>
>> Regards,
>> Jay
>> ------------------------------------------------------------------------
>> *From:* Mahfooz, Hamza <Hamza.Mahfooz at amd.com>
>> *Sent:* Tuesday, September 27, 2022 3:12 PM
>> *To:* linux-kernel at vger.kernel.org <linux-kernel at vger.kernel.org>
>> *Cc:* Mahfooz, Hamza <Hamza.Mahfooz at amd.com>; Wentland, Harry 
>> <Harry.Wentland at amd.com>; Li, Sun peng (Leo) <Sunpeng.Li at amd.com>; 
>> Siqueira, Rodrigo <Rodrigo.Siqueira at amd.com>; Deucher, Alexander 
>> <Alexander.Deucher at amd.com>; Koenig, Christian 
>> <Christian.Koenig at amd.com>; Pan, Xinhui <Xinhui.Pan at amd.com>; David 
>> Airlie <airlied at linux.ie>; Daniel Vetter <daniel at ffwll.ch>; Lee, Alvin 
>> <Alvin.Lee2 at amd.com>; Hung, Alex <Alex.Hung at amd.com>; Kotarac, Pavle 
>> <Pavle.Kotarac at amd.com>; Wang, Chao-kai (Stylon) 
>> <Stylon.Wang at amd.com>; Pillai, Aurabindo <Aurabindo.Pillai at amd.com>; 
>> Ma, Leo <Hanghong.Ma at amd.com>; Wu, Hersen <hersenxs.wu at amd.com>; Po-Yu 
>> Hsieh Paul <Paul.Hsieh at amd.com>; Jimmy Kizito <Jimmy.Kizito at amd.com>; 
>> amd-gfx at lists.freedesktop.org <amd-gfx at lists.freedesktop.org>; 
>> dri-devel at lists.freedesktop.org <dri-devel at lists.freedesktop.org>
>> *Subject:* [PATCH] drm/amd/display: fix array-bounds error in 
>> dc_stream_remove_writeback()
>> Address the following error:
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function 
>> ‘dc_stream_remove_writeback’:
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: 
>> error: array subscript [0, 0] is outside array bounds of ‘struct 
>> dc_writeback_info[1]’ [-Werror=array-bounds]
>>   527 | stream->writeback_info[j] = stream->writeback_info[i];
>>       | ~~~~~~~~~~~~~~~~~~~~~~^~~
>> In file included from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc.h:1269,
>>                  from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/inc/core_types.h:29,
>>                  from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dc_common.h:29,
>>                  from 
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:27:
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc_stream.h:241:34: note: 
>> while referencing ‘writeback_info’
>>   241 |         struct dc_writeback_info writeback_info[MAX_DWB_PIPES];
>>       |
>>
>> Currently, we aren't checking to see if j remains within
>> writeback_info[]'s bounds. So, add a check to make sure that we aren't
>> overflowing the buffer.
>>
>> Signed-off-by: Hamza Mahfooz <hamza.mahfooz at amd.com>
>> ---
>>  drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
>> b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> index 3ca1592ce7ac..ae13887756bf 100644
>> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> @@ -520,7 +520,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
>>          }
>>
>>          /* remove writeback info for disabled writeback pipes from 
>> stream */
>> -       for (i = 0, j = 0; i < stream->num_wb_info; i++) {
>> +       for (i = 0, j = 0; i < stream->num_wb_info && j < 
>> MAX_DWB_PIPES; i++) {
>>                  if (stream->writeback_info[i].wb_enabled) {
>>                          if (i != j)
>>                                  /* trim the array */
>> -- 
>> 2.37.2
>>

-- 
Hamza